Tesco was accused this week of failing to have proper fraud prevention measures in place after a couple’s identities were stolen and used to take out mobile phone contracts.

The first Andy Firth, who lives with his partner Jayne Wolliner, knew about the problem was when he opened what looked like junk mail to find a letter asking why he hadn’t paid his Tesco Mobile bill. Until this point he’d had no dealings with the company.

Tesco Mobile sent Wolliner a similar letter – though the name on it was “Mr J Wollinei”. She has since been chased by Tesco-appointed debt collectors Fredrickson International for £690 – the amount racked up by whoever used her address to buy the phone.

The couple, who live in Letchworth, Hertfordshire, had unwittingly been caught up in one of the fastest growing areas of fraud, ID theft, which has jumped almost 40% over the past year. They now face having to scrutinise their credit files and register with fraud warning agencies to prevent further such incidents.

Firth, who runs his own internet business, is furious at how much time he has had to devote to sorting the matter out, in the face of what he describes as Tesco’s “complete lack of care”. There was no phone number on the first letter Tesco sent, forcing him to spend hours on the phone to head office trying to find someone who would deal with the phantom account.

Growing increasingly frustrated at being asked for personal details, he eventually stormed into his local Tesco store and refused to leave until something was done about it.

Though the matter has since been resolved, he says he has not been told how someone was able to acquire phones in both their names. No apology has been offered, he says, nor has he been compensated for his time.

“It appears the fraudsters got our details from the electoral roll but used someone else’s bank details, but even now I’m not certain. When I phoned Tesco, they originally refused to deal with me because I wouldn’t hand over my date of birth. They eventually asked me who I banked with, and named a different bank to mine. It took me ages to convince them that this phone was nothing to do with me.”

He says simple checks such as cross referencing the bank details to his home address would have shown the application to be a fraud. Guardian Money has since learned that the phone contracts were taken out in-store by people impersonating the couple, armed with some “ID”. In Firth’s case, they were able to give his date of birth but got his mother’s maiden name wrong. Despite the fact that the fraudsters used a different person’s bank details to set up the contract, Tesco staff handed over the handsets.

“This must be happening all the time, but Tesco treated it as if it were a minor inconvenience. If it happens to you, it’s not minor – it’s a major problem. I’ve now got to check my credit scores, all because someone at Tesco wasn’t doing their job properly. It can’t be right that I have to go through this aggravation,” he says.

Richard Hurley, of the fraud prevention bureau Cifas, says the couple’s story is all too familiar. In the past, fraudsters have set up Royal Mail redirects to intercept bills that can be used in frauds such as these. Other letters are posted through the victim’s letterboxes by the fraudsters, leaving the homeowner unaware it is happening.

“If you are the victim of this kind of fraud it is worth making your bank and bank card providers aware this has happened. They will then keep an eye out for suspicious transactions. It is also advisable to be extra-vigilant in checking bank statements, and to check your credit report.”

The most recent figures from Cifas show there were 35,983 reported cases of ID fraud during the first three months of this year – up 39.6% on the same period in 2011.

“Organisations must recognise that the challenges posed by misuse of details and accounts are severe, and invest in proven technologies and techniques to prevent losses to themselves and their customers,” Hurley says.

A spokeswoman for Tesco saysit is taking on board Firth’s feedback and adds that customers are normally sent a welcome pack with contact information. “To prove a case of fraud we need our customers to give us an amount of personal information, which allows us to confirm the account is indeed fraudulent. In this case, the customer was unwilling to provide that data for a certain period of time, which held up the closure of the account. We are in contact with the customer and have offered them a gesture of goodwill. We will also be reviewing our communications to ensure contact information is clear in all correspondence.”